Joint authorization policy conflict detection and enforcement method based on decision tree

Abstract

The application discloses a joint authorization strategy conflict detection and execution method based on a decision tree, which comprises the following steps: constructing a decision tree model according to a set of each strategy for the same user formulated by different network managers; training the decision tree model based on the constructed decision tree model; and performing conflict detection and execution on the joint authorization strategy through the trained decision tree model. The application can realize fast speed, small calculation amount, and generated classification rules are easy to understand, and the decision tree model can be verified through statistical testing of verification data.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method for detecting and executing joint authorization strategy conflicts based on decision trees. Background Technology

[0002] Joint authorization primarily refers to different network administrators restricting user access to data. This can lead to multiple policies affecting a user's access to a particular type of data, potentially causing policy conflicts. Therefore, the key issue addressed by this invention is first detecting policy conflicts and then implementing joint authorization policies accordingly. It is important to note that the premise for studying policy conflict problems is that multiple policies should apply to the same object.

[0003] The paper "Research on Role-Based Joint Authorization Management" (Computer Engineering and Design, 2010, 31(15), 3343-3349) addresses the issue of dividing the functions of network administrators by adopting a joint decision-making approach among multiple administrators for important roles and permissions, thereby improving the correctness and security of management operations. The patent "Joint Authorization Method and Device" (ZL201911334179.3) addresses the application example of performing joint authorization operations by employing a serial processing method with multiple strategies nested among each other to process joint authorization requests, and provides definitions and usage instructions for each functional unit in the implementation architecture of the device. The joint authorization methods proposed in the above papers and patents are only applicable to scenarios where the authorization structure and attribute set are relatively simple. When many network administrators set multiple strategies that are logically scattered or even conflicting with each other for a certain type of object, and the authorization structure itself suffers from attribute explosion, the above joint authorization methods will no longer be applicable.

[0004] The patent "A System and Method for Implementing Joint Authorization in an Encrypted System" (ZL200510105607.7) addresses access control criteria for digital television programs. It integrates various conditional access processing modules on a set-top box, decrypts encrypted scrambling control words based on each instant authorization control word message in the program stream, and uses the decrypted scrambling control words to descramble the program stream. The patent "Joint Authorized User Perception and Link State Estimation Method and Apparatus" (ZL201410155420.7) addresses the joint spectrum perception and link state estimation problem in cognitive radio. It establishes an authorized user perception and joint link state estimation model to estimate the link state information of authorized users and secondary users and schedule radio resources. The technical background and application scenarios of the above two patents differ significantly from those of this invention.

[0005] Traditional joint authorization methods primarily optimize data access control policies locally. This involves performing multi-set operations on the subject, object, and environment attributes of the conditional expressions in policy statements defined by different network administrators, including finding intersections, unions, and differences. Then, the methods check whether the actions performed on the same object in different policy statements are consistent; inconsistencies result in conflicts. In scenarios with complex data access control authorization structures and attribute sets, the efficiency of policy decision-making and execution steps gradually decreases until they become completely ineffective due to the fragmented and potentially conflicting logic of multiple policies and the existence of attribute explosion problems within the authorization structure itself. Summary of the Invention

[0006] In view of this, the present invention provides a joint authorization strategy conflict detection and execution method based on decision tree to solve the above-mentioned technical problems.

[0007] This invention discloses a method for detecting and executing joint authorization policy conflicts based on decision trees, which includes the following steps:

[0008] Step 1: Construct a decision tree based on multiple policies formulated by different network administrators that apply to the same user;

[0009] Step 2: Train the decision tree model based on the constructed decision tree;

[0010] Step 3: Use the trained decision tree model to perform conflict detection and execution on the joint authorization strategy.

[0011] Further, step 1 includes:

[0012] Each policy formulated by different network administrators and applied to the same user is divided into multiple subsets.

[0013] Starting from the root node of the decision tree, split it into decision nodes and leaf nodes;

[0014] The current level decision node is split into decision nodes and leaf nodes in turn, until all features and all strategies of each strategy have been traversed;

[0015] Each subset is assigned to a leaf node, thus constructing a decision tree. The output of the decision tree is an executable joint authorization strategy.

[0016] Furthermore, the decision node is mainly used to determine the logical relationships between multiple subsets in different strategies;

[0017] When the result of the judgment does not require further decision-making, the branch of the decision node becomes a leaf node. In scenarios where data can be accessed by users, such leaf nodes are represented by attributes in the policy condition expression that do not have intersection. When the branch needs further decision-making, the branch of the decision node becomes the next decision node.

[0018] Further, step 2 includes:

[0019] Step 21: Import the training data into the policy execution point to send an authorization request to the policy decision point;

[0020] Step 22: Based on the authorization request, the strategy decision point performs strategy judgment and decision-making and trains the decision tree model;

[0021] Step 23: Based on the strategy judgment and decision, return the strategy information.

[0022] Further, step 21 includes:

[0023] The strategy and its logical judgment results are obtained as training data, and the training data is imported into the strategy execution point to generate authorization requests. The training data is labeled as either strategy executable or strategy conflict, i.e., "strategy not executable". The strategy execution point is a program component that controls the use of the strategy.

[0024] Further, step 22 includes:

[0025] The policy execution point sends the generated authorization request to the policy decision point. The policy decision point is responsible for executing the policy judgment and decision. That is, if any one of the multiple policies is to deny, the result is to deny. If none of the policies deny, the result is to grant.

[0026] The strategy decision point training decision tree model uses training set data to determine the attributes used in decision-making, and determines the attribute division of the root node, decision node and leaf node.

[0027] Further, step 23 includes:

[0028] Classification rules are derived from the training dataset and sent to the policy management point; wherein, the policy management point is a system entity that creates policies, policy sets and manages them;

[0029] The strategy management point is responsible for tuning the parameters of the classification decision tree model, adjusting the Gini index until all training data are initially correctly classified.

[0030] Strategic decision points need to query strategic information points to collect descriptive information related to attributes, or search for strategic information provided by other third parties;

[0031] Return strategy information from the strategy information point to the strategy decision point.

[0032] Further, step 3 includes:

[0033] Step 31: Obtain data access control policy information as test data and import the test data into the policy enforcement point; the policy enforcement point classifies the policies formulated by multiple network administrators that affect the same user's data access and generates authorization requests to send to the policy decision point.

[0034] Step 32: Based on the received authorization request and the constructed decision tree model, the strategy decision point obtains an executable joint authorization strategy;

[0035] Step 33: Query strategy information points to collect descriptive information related to attributes, or search for strategy information provided by other third parties;

[0036] Step 34: Return policy information from the policy information point to the policy decision point; the policy decision point makes a judgment on the user's access request based on the joint authorization policy and returns an authorization response to the policy enforcement point;

[0037] Step 35: The policy execution point responds to the returned authorization response, and the user provides feedback on the response result to the policy information point and the policy management point based on the joint authorization policy.

[0038] Further, step 32 includes:

[0039] The strategy decision point parses the authorization request sent by the strategy execution point, obtains multiple strategies for data access, and uses these multiple strategies as input information for the decision tree model.

[0040] The fourth step is to break down each input strategy into multiple subsets, use a decision tree model to determine the logical relationships between multiple attributes, classify the determination results based on the logical relationships between attributes, and generate the output information of the decision tree model, which is the executable joint authorization strategy.

[0041] Further, step 35 includes:

[0042] The policy execution point performs corresponding operations based on the authorization response returned by the policy decision point. When permission is granted, the data is operated on according to the corresponding operation permissions. The operations include copying, sending, modifying, and deleting.

[0043] Users provide feedback on the results of their data operations based on the joint authorization strategy to the strategy information point, which then generates and saves the corresponding data operation logs. Users also provide feedback on the results of their data operations based on the joint authorization strategy to the strategy management point, which then adjusts the parameters of the decision tree model.

[0044] Because of the adoption of the above technical solution, the present invention has the following advantages:

[0045] 1. The joint authorization strategy has fast conflict detection and execution speed. Compared with traditional joint authorization methods such as multi-set operations, the computational load is relatively small. The generated classification rules are easy to understand and the decision tree model can be verified through statistical testing of validation data.

[0046] 2. The decision tree model training in the model training phase is a recursive "small loop" process. In the prediction phase, from "importing data access control policy information" to "determining the joint authorization policy based on the decision tree model", then to "executing data operations" and "feedback policy information", and finally to "optimizing the authorization model", it is a feedback optimization "large loop" process. The combined use of the two loops makes the joint authorization policy conflict detection highly accurate and the classification criteria formed highly accurate. Attached Figure Description

[0047] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments recorded in the embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0048] Figure 1 This is a schematic diagram of the joint authorization strategy conflict detection and execution process based on decision tree according to an embodiment of the present invention;

[0049] Figure 2 This is a schematic diagram of the joint authorization structure and construction method based on decision tree according to an embodiment of the present invention;

[0050] Figure 3(a) is a schematic diagram of the data access control strategy and its model training phase in an embodiment of the present invention;

[0051] Figure 3(b) is a schematic diagram of the data access control strategy and its prediction stage process according to an embodiment of the present invention. Detailed Implementation

[0052] The present invention will be further described in conjunction with the accompanying drawings and embodiments. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. All other embodiments obtained by those skilled in the art should fall within the protection scope of the present invention.

[0053] As attached Figure 1 As shown, this invention addresses the issue of multiple policies formulated by multiple network administrators regarding whether the same object can be accessed. It constructs a joint authorization model based on a decision tree (referred to as the "decision tree model"). This model can realize the decision of joint authorization policies, avoiding the problem of policies failing to be executed or failing due to the complexity of the authorization structure and attribute set of multiple policies themselves.

[0054] This invention proposes an embodiment of a joint authorization policy conflict detection and execution method based on decision trees. It first needs to detect whether policy conflicts exist, and then uses corresponding methods to resolve policy conflicts. This is the key technical problem solved by this invention.

[0055] Multiple network administrators may formulate different policies for the same user's access to certain data. This can lead to mutual constraints or influences between multiple policies. If policies conflict, it may even prevent the current policy from being properly decided or executed. Joint authorization should accurately describe the permissions and related constraints that a user (subject) has when accessing specific data (object); at the same time, secure and effective technical measures should be taken to ensure that the above authorization and constraint terms are correctly executed.

[0056] Attribute-based access control is a flexible authorization structure. Attributes mainly include subject attributes, object attributes, context attributes, and operation attributes. In data access scenarios, the subject refers to the user accessing the data, the object refers to the data being accessed, the context refers to the current time, location, or actual operating environment when the data access occurs, and the operation refers to whether the user has permission to perform a certain operation on the data, such as copying, sending, modifying, or deleting.

[0057] A policy refers to the set of security rules that a subject (data accessor) must follow when performing a certain operation on an object (data). It mainly includes two decision factors: conditions and authorization. The first part of a policy statement is the condition, which can generally be represented by a judgment expression. The condition expression is often based on the attributes of the subject, object, and environment. The second part of a policy statement is the authorization. The operation authorization in the second part can only be obtained if and only if the condition expression in the first part of the policy statement is true.

[0058] Decision trees are a machine learning method primarily used for classification, belonging to supervised learning. Commonly used decision tree algorithms include ID3, C4.5, and Classification and Regression Tree (CART). These three algorithms use information gain, information gain ratio, and the Gini coefficient (GINI) as the criteria for attribute splitting, respectively, determining which node becomes the predecessor node and how it splits into subsequent nodes. This method uses the Classification and Regression Tree algorithm, where a predecessor node can only split into two successor nodes; the logical judgment result is either "attributes do not intersect" or "attributes intersect." A decision tree can be represented by a quintuple (I, G, D, F, O).

[0059] As attached Figure 2 As shown, I represents the input information of the decision tree, which is a set of m policies P1, P2, ..., P1 formulated by different network administrators to act on the same user's access to a certain type of data. m , I = {P i |1≤i≤m}. G represents the root node of the decision tree. Each input policy is split into multiple subsets, where the conditional expression of a policy contains n attributes, which can be represented as P. i ={atr ij |1≤i≤m,1≤j≤n}. Starting from G, each step in the decision tree process splits a preceding node into two subsequent nodes, including a decision node and a leaf node. D represents the decision node that the decision tree judges at each step. The preceding node of a decision node is the previous decision node, and the subsequent nodes are either leaf nodes or the next decision node. Decision nodes are mainly used to determine the logical relationships between multiple subsets in different strategies. When the judgment result does not require further decision-making, the branch becomes a leaf node. In scenarios where data accessibility is a concern, such leaf nodes represent attributes in the strategy condition expression that do not intersect. When the branch requires further decision-making, it becomes the next decision node. For any two distinct attributes atr... ij and atr uv Where i≠u, j≠v, if two attributes atr ij and atr uv If there is an intersection, it can be represented as: If two attributes have no intersection, it can be represented as If two attributes atr ij and atr uv If there is an intersection, first determine whether there is an equality or inequality relationship between the two, which can be represented as atr. ij =atr uv or atr ij ≠atruv Then determine whether there is an inclusion relationship between the two, atr ij It is ATR uv A subset of can be represented as atr uv It is ATR ij A subset of can be represented as F represents the leaf nodes of the decision tree, which represent all possible decisions. Leaf nodes are not further segmented; the leaf node selected during the decision-making process is output as the final decision. O represents the output information of the decision tree, i.e., the output of m strategies P1, P2, ..., Pn using the decision tree method. m After processing, an executable joint authorization strategy is obtained, which is O = f(I) = f(P1, P2, ..., P...). m P i As the root node, the atr contains the main attributes, environment attributes, and operation attributes. ij and atr uv The logical relationships are used as decision nodes in sequence, where i≠u and j≠v. The process is repeated recursively using j=j++ and v=v++ until strategy P is traversed. i Based on all the features, and on this basis, recursively iterate through all strategies I = {P} using i = i++ and u = u++ until all strategies I = {P} have been traversed. i |1≤i≤m}. Finally, each subset is assigned to a leaf node, thus constructing a decision tree.

[0060] Data access control strategies and processes mainly include two stages: model training and prediction. As shown in Figure 3(a), the model training process includes the following steps:

[0061] The first step is to obtain a large number of diverse and high-quality policies and their logical judgment results as training data. The training data is labeled as either policy executable or policy conflict (i.e., "policy not executable"). The training data is then imported into the policy enforcement point (PEP), which is a program component that controls the use of policies and is responsible for generating authorization requests.

[0062] The second step is for the policy execution point to send the generated authorization request to the policy decision point (PDP). The policy decision point is responsible for executing the policy judgment and decision. This invention adopts a "rejection priority" mechanism. The basic idea is that if any policy among multiple policies results in rejection (i.e., "attributes do not intersect"), the result is rejection (i.e., "joint authorization policy detected as conflict"). If none of the policies results in rejection (i.e., "attributes intersect"), the result is permission (i.e., "joint authorization policy detected as executable").

[0063] The third step involves training the decision tree model using strategy decision points. During training, the training set data is used to determine the attributes used in decision-making, and the attribute partitioning of the root node, decision nodes, and leaf nodes is determined. A detailed process for building the decision tree model is attached. Figure 2 The document shows the "joint authorization structure and construction method based on decision trees";

[0064] The fourth step is to summarize the classification rules from the training dataset and send these rules to the policy administration point (PAP). The policy administration point is a system entity that creates policies, policy sets and manages them.

[0065] The fifth step involves the strategy management point being responsible for tuning the parameters of the classification decision tree model. By adjusting the Gini index, the goal is twofold: first, to reduce the probability of randomly selected samples from the sample set being misclassified; and second, to prevent overfitting during model training, until all training data is classified correctly.

[0066] The sixth step is to provide more accurate decision-making. The policy decision point needs to query the policy information point (PIP) to collect descriptive information related to the attribute, or search for policy information provided by other third parties.

[0067] Step 7: Return strategy information from the strategy information point to the strategy decision point.

[0068] As shown in Figure 3(b), the prediction phase of the data access control strategy and process based on the decision tree model includes the following steps:

[0069] The first step is to obtain data access control policy information as test data and import the test data into the policy execution point;

[0070] The second step is for the policy enforcement point to categorize the policies formulated by multiple network administrators that apply to the same user's data access, and then generate an authorization request to send to the policy decision point.

[0071] The third step involves the policy decision point parsing the authorization request sent by the policy execution point to obtain multiple data access policies P. i , 1≤i≤m, and multiple strategies are used as input information for the decision tree model, i.e., I={P i |1≤i≤m};

[0072] The fourth step involves splitting each input strategy into multiple subsets, using the decision tree model built during the model training phase to determine the logical relationships between multiple attributes, and classifying the results based on these relationships to generate the output information of the decision tree model, which is the executable joint authorization strategy: O = f(I) = f(P1, P2, ..., P...). m );

[0073] The fifth step involves querying strategy information points to collect descriptive information related to attributes, or searching for strategy information provided by other third parties.

[0074] Step 6: Return strategy information from the strategy information point to the strategy decision point;

[0075] Step 7: The policy decision point makes a judgment on the user's access request based on the joint authorization policy and returns an authorization response to the policy enforcement point;

[0076] Step 8: The strategy execution point performs the corresponding operation based on the authorization response returned by the strategy decision point. When permission is granted, the data is operated on according to the corresponding operation permissions, including copying, sending, modifying, deleting, etc.

[0077] The ninth step involves the user providing feedback on the data operation results based on the joint authorization policy to the policy information point, which then generates and saves the corresponding data operation log records.

[0078] Step 10: The user provides feedback on the data operation results based on the joint authorization strategy to the strategy management point, which then corrects the parameters of the decision tree model.

[0079] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for detecting and executing joint authorization strategies based on decision trees, characterized in that, Includes the following steps: Step 1: Construct a decision tree based on multiple policies formulated by different network administrators that apply to the same user; Step 2: Train the decision tree model based on the constructed decision tree; Step 3: Use the trained decision tree model to perform conflict detection and execution on the joint authorization strategy; Step 1 includes: The input information for the decision tree is a set of m policies formulated by different network administrators, each affecting the same user's access to a certain type of data. The root node of the decision tree is used to split each of the m policies into multiple subsets, where a policy contains... n The decision tree consists of several attributes. Starting from the root node, each step of the decision tree process splits a preceding node into two subsequent nodes: a decision node and a leaf node. The preceding node of a decision node is the previous decision node, and the subsequent node is either a leaf node or the next decision node. Decision nodes are mainly used to determine the logical relationships between multiple subsets in different strategies. When the decision result does not require further decision-making, the corresponding branch becomes a leaf node. In scenarios where data accessibility is uncertain, this type of leaf node indicates that the attributes in the strategy do not intersect. When this branch requires decision-making, it becomes the next decision node. For any two different attributes, if they intersect, the intersection is not empty; if they do not intersect, the intersection is empty. If two attributes intersect, the system first determines whether they are equal or unequal, and then determines whether they are inclusive. The leaf nodes of the decision tree represent all possible decision results. Leaf nodes are not further split, and the leaf node selected during decision-making is output as the final decision result.

2. The method according to claim 1, characterized in that, Step 2 includes: Step 21: Import the training data into the policy execution point to send an authorization request to the policy decision point; Step 22: Based on the authorization request, the strategy decision point performs strategy judgment and decision-making and trains the decision tree model; Step 23: Based on the strategy judgment and decision, return the strategy information.

3. The method according to claim 2, characterized in that, Step 21 includes: The strategy and its logical judgment results are obtained as training data, and the training data is imported into the strategy execution point to generate the authorization request. The training data is labeled as either strategy executable or strategy conflict, i.e., "strategy not executable". The strategy execution point is a program component that controls the use of the strategy.

4. The method according to claim 2, characterized in that, Step 22 includes: The policy execution point sends the generated authorization request to the policy decision point. The policy decision point is responsible for executing the policy judgment and decision. That is, if any one of the multiple policies is to deny, the result is to deny. If none of the policies deny, the result is to grant. The strategy decision point training decision tree model uses training set data to determine the attributes used in decision-making, and determines the attribute division of the root node, decision node and leaf node.

5. The method according to claim 2, characterized in that, Step 23 includes: Classification rules are derived from the training dataset and sent to the policy management point; wherein, the policy management point is a system entity that creates policies, policy sets and manages them; The strategy management point is responsible for tuning the parameters of the classification decision tree model, adjusting the Gini index until all training data are initially correctly classified. Strategic decision points need to query strategic information points to collect descriptive information related to attributes, or search for strategic information provided by other third parties; Return strategy information from the strategy information point to the strategy decision point.

6. The method according to claim 1, characterized in that, Step 3 includes: Step 31: Obtain data access control policy information as test data and import the test data into the policy enforcement point; the policy enforcement point classifies the policies formulated by multiple network administrators that affect the same user's data access and generates authorization requests to send to the policy decision point. Step 32: Based on the received authorization request and the constructed decision tree model, the strategy decision point obtains an executable joint authorization strategy; Step 33: Query strategy information points to collect descriptive information related to attributes, or search for strategy information provided by other third parties; Step 34: Return policy information from the policy information point to the policy decision point; the policy decision point makes a judgment on the user's access request based on the joint authorization policy and returns an authorization response to the policy enforcement point; Step 35: The policy execution point responds to the returned authorization response, and the user provides feedback on the response result to the policy information point and the policy management point based on the joint authorization policy.

7. The method according to claim 6, characterized in that, Step 32 includes: The policy decision point parses the authorization request sent by the policy execution point to obtain multiple policies for data access. ， And multiple strategies are used as input information for the decision tree model; Each input strategy is broken down into multiple subsets. A decision tree model is used to determine the logical relationships between multiple attributes. The results are then categorized based on these relationships to generate the output information of the decision tree model, which is the executable joint authorization strategy.

8. The method according to claim 6, characterized in that, Step 35 includes: The policy execution point performs corresponding operations based on the authorization response returned by the policy decision point. When permission is granted, the data is operated on according to the corresponding operation permissions. The operations include copying, sending, modifying, and deleting. Users provide feedback on the results of their data operations based on the joint authorization strategy to the strategy information point, which then generates and saves the corresponding data operation logs. Users also provide feedback on the results of their data operations based on the joint authorization strategy to the strategy management point, which then adjusts the parameters of the decision tree model.

Images